0

With the way Tor works, you are tied to a fixed Entry Guard for quite a reasonable time. If you are unlucky, you might get connected to a bad Entry Guard Node owned by X. From now on, it is only a matter of time until you are randomly connected to a bad Exit Node, also in control of X. This is due to Tor keeping the Entry Guard stable for a reasonable time but very frequently changes the Middle- and Exit Node.

I have been wondering why Tor doesn't come with a solution for this by default. For example: If I would be connected to an Entry Guard Node from the UK, wouldn't it be a very smart move to go to

" User > Tor Browser > Browser > Data > Tor > torrc "

and add the following line to the torrc file:

" ExcludeExitNodes {UK}

StrictNodes 1 " ?

If we assume you are connected to a bad Entry Guard Node owned by X, wouldn't it be extremely unlikely that X also runs an Exit Node from a different country?

My solution would prevent the Exit Guard Node from being from the same country as the Entry Guard Node. Doesn't that solve the mentioned problem?

  • i would also be interested in this. i have been wondering before why tor allows the exit node to be from same country like entry guard node. is there reason for this? does named solution in here make sense? – gabor.robag Feb 10 at 7:22
  • i don't get it why this should improve your anonymity...? - the internet/deepweb/etc. doesn't respect borders and even less attackers do. – DJCrashdummy Feb 11 at 8:30
  • hopefully this answers your question (at least partly): torproject.org/docs/faq#ChoosePathCountries – DJCrashdummy Feb 11 at 8:31
0

I really don't want to spam or anything, but as I had another question regarding this issue, I thought it would be ok to give it a little push and re-ask if this wouldn't be a good idea.

Additionally I noted, excluding an entry Node from a country doesn't seem to work by 100%. I made Tor create a new circuit for a website for about 100 times. During this, there was a single time where Tor chose to connect me to an Excluded Exit Node. Does someone know why this happened? A display Bug?

New contributor
PomBa76 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0

@DJCrashdummy, as I have been posting here as guest exclusively, I can't directly reply to you by dropping a comment below.

Thank you for the provided information. Your article seems to mostly aim at heavily restricting both Entry Guard Node and Exit Node, if not even restricting them to a single country. That would obviously come with a risk. My case however is quite a bit different. As my Entry Guard Node isn't really supposed to change, I only plan to exclude one single country from providing me any kind of Exit Nodes. Only excluding a single country from my Exit Node would have probably a much lower risk, if not it might even have a certain benefit. Maybe someone can supply me with deeper knowledge of my special case.

I still think that an adversary poses the biggest thread if he has you connecting to an Entry Guard Node and an Exit Node that is within the same country. But maybe I'm all wrong and should stick to using the torrc file with all the default settings.

New contributor
PomBa76 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • [...] maybe I [...] should stick to using the torrc file with all the default settings. - i'm pretty sure this is the better idea. ;-) – DJCrashdummy Feb 11 at 21:30
0

@ DJCrashdummy - Thank you for your answer, again. Do you by any chance have any further knowledge why I should rather stick to the original torrc file? For me, it just seems the most likely thing that adversary only controls Nodes in one and the same country. Your link mentions that my Tor Browser will stick out, because it is different from the way I changed my torrc file. But the way Tor Browser works, adversary won't be able to see how my Tor Browser is configurated. It would only make sense if restricting a single country from beeing my Exit Node could cause something in the Tor mechanisms to fail.

There won't be an error from my site. I'm not wildly surfing around the deep web. I'm not downloading anything. I have all kind of scripts disabled. The only deanonymization factor would be adversary controlling both Entry Guard Node and Exit Node, which just seems much, much more likely to be happening within the same country. Can you clarify?

New contributor
PomBa76 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Do you by any chance have any further knowledge why I should rather stick to the original torrc file? - not exactly, but i'm pretty sure the Tor devs have carefully chosen the defaults. – DJCrashdummy Feb 12 at 15:53
  • For me, it just seems the most likely thing that adversary only controls Nodes in one and the same country. - also if you repeat it 100 times, it doesn't get more true... why do you think so?!? you just need a few bucks to rent a server in a different country to setup a Tor node... e.g. even my ordinary clearnet server is located in a different country than i'm living in. – DJCrashdummy Feb 12 at 15:57
0

following this with interest and doing own researches. restricting entry guard node and exit guard node too much like only allowing one country to chose will make your tor browser connection stand out. adversary will find suspicious if there is always one connection from lets say entry point united kingdom and exit point russia. this might stand out and be linked together which makes deanonymization more easy. i dont think you do harm only excluding one single country from exit node (entry guard node country). depending what you do on tor and depending what country you reside in, it can make sense if your entry guard is your country and you fear adversary (government) from your country aiming at you because you break the law in your country but maybe not at other. so you restrict exit guard node from being your country as well.

if you for example live in poor country with no freedom of speech it maybe makes sense to restrict your own country to be your exit node. because other countries will maybe not pass information to them and maybe they dont have the money/possibility (maybe not even interest) to rent server abroad.

New contributor
gabor.robag is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.